Following up on the scope note in #122, which deliberately left outbound webhook signing for a follow up. Measured live against the reference server at a95b928, the order event webhook path has three gaps relative to the 2026-04-08 order specification:
1. Deliveries are not signed at all
checkout_service._notify_webhook posts the order entity with no Signature, Signature-Input, or Content-Digest header, and no UCP-Agent header identifying the business profile. order.md, Webhook Signature Verification, lists all four as required headers on every delivery, and states that webhook payloads MUST be signed. The signing machinery already exists server side since #122 (ucp_signing.sign_request); wiring it into _notify_webhook with a configured signing key is the natural shape.
2. Failed deliveries are never retried
_notify_webhook performs a single httpx.post and does not inspect the response status, so a 5xx from the platform receiver is silently dropped. order.md requires retrying failed deliveries.
3. Positive observations, for completeness
Webhook-Id and unix Webhook-Timestamp are sent correctly, and the body is the full order entity (the #140 contract holds).
The conformance suite side of this is in flight as conformance#73: its signing envelope tests currently skip loudly against this server ("server sends unsigned webhook deliveries"), and they un skip and pass against a merchant that signs, so a fix here gets immediate coverage.
I am happy to build the fix for both gaps as offered in #122, in whichever shape you prefer (for example a --webhook_signing_key flag defaulting to the existing demo key, plus a bounded retry with backoff).
Following up on the scope note in #122, which deliberately left outbound webhook signing for a follow up. Measured live against the reference server at a95b928, the order event webhook path has three gaps relative to the 2026-04-08 order specification:
1. Deliveries are not signed at all
checkout_service._notify_webhookposts the order entity with noSignature,Signature-Input, orContent-Digestheader, and noUCP-Agentheader identifying the business profile. order.md, Webhook Signature Verification, lists all four as required headers on every delivery, and states that webhook payloads MUST be signed. The signing machinery already exists server side since #122 (ucp_signing.sign_request); wiring it into_notify_webhookwith a configured signing key is the natural shape.2. Failed deliveries are never retried
_notify_webhookperforms a singlehttpx.postand does not inspect the response status, so a 5xx from the platform receiver is silently dropped. order.md requires retrying failed deliveries.3. Positive observations, for completeness
Webhook-Idand unixWebhook-Timestampare sent correctly, and the body is the full order entity (the #140 contract holds).The conformance suite side of this is in flight as conformance#73: its signing envelope tests currently skip loudly against this server ("server sends unsigned webhook deliveries"), and they un skip and pass against a merchant that signs, so a fix here gets immediate coverage.
I am happy to build the fix for both gaps as offered in #122, in whichever shape you prefer (for example a
--webhook_signing_keyflag defaulting to the existing demo key, plus a bounded retry with backoff).